php php 4.0.4 vulnerabilities and exploits

(subscribe to this query)

PHP 4.0 up to and including 4.1.1 stores session IDs in temporary files whose name contains the session ID, which allows local users to hijack web connections.

Php Php 4.0.4 Php Php 4.0.5 Php Php 4.0.6 Php Php 4.1.0 Php Php 4.1.2

PHP Apache module 4.0.4 and previous versions allows remote malicious users to bypass .htaccess access restrictions via a malformed HTTP request on an unrestricted page that causes PHP to use those access controls on the next page that is requested.

Php Php 4.0 Php Php 4.0.1 Php Php 4.0.3 Php Php 4.0.4 Mandrakesoft Mandrake Linux 7.2

The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.

Php Php 4.0 Php Php 4.0.1 Php Php 4.0.3 Php Php 4.0.4 Mandrakesoft Mandrake Linux 7.2

PHP, when not configured with the "display_errors = Off" setting in php.ini, allows remote malicious users to obtain the physical path for an include file via a trailing slash in a request to a directly accessible PHP program, which modifies the base path, causes the in...

Php Php 4.0 Php Php 4.0.1 Php Php 4.0.3 Php Php 4.0.4 Php Php 4.0.5 Php Php 4.0.6 Php Php 4.1.0 Php Php 4.1.2

PHP 4.0 with cURL functions allows remote malicious users to bypass the open_basedir setting and read arbitrary files via a file: URL argument to the curl_init function.

Php Php 4.0 Php Php 4.0.1 Php Php 4.0.2 Php Php 4.0.3 Php Php 4.0.4 Php Php 4.0.5 Php Php 4.0.6 Php Php 4.0.7

1 EDB exploit

bb_smilies.php and bbcode_ref.php in PHP-Nuke 4.4 allows remote malicious users to read arbitrary files and gain PHP administrator privileges by inserting a null character and .. (dot dot) sequences into a malformed username argument.

Francisco Burzi Php-nuke 4.0.4 Francisco Burzi Php-nuke 4.4

The mail function in PHP 4.x to 4.2.2 does not filter ASCII control characters from its arguments, which could allow remote malicious users to modify mail message content, including mail headers, and possibly use PHP as a "spam proxy."

Php Php 3.0.18 Php Php 4.0 Php Php 4.0.1 Php Php 4.0.2 Php Php 4.0.3 Php Php 4.0.4 Php Php 4.0.5 Php Php 4.0.6 Php Php 4.0.7 Php Php 4.1.0 Php Php 4.1.1 Php Php 4.1.2

CRLF injection vulnerability in PHP 4.2.1 up to and including 4.2.3, when allow_url_fopen is enabled, allows remote malicious users to modify HTTP headers for outgoing requests by causing CRLF sequences to be injected into arguments that are passed to the (1) fopen or (2) file fu...

Php Php 3.0.14 Php Php 3.0.15 Php Php 3.0.16 Php Php 3.0.17 Php Php 3.0.18 Php Php 4.0.3 Php Php 4.0.4 Php Php 4.0.5 Php Php 4.0.6 Php Php 4.0.7 Php Php 4.1.0 Php Php 4.1.1

Integer signedness error in emalloc() function for PHP prior to 4.3.2 allow remote malicious users to cause a denial of service (memory consumption) and possibly execute arbitrary code via negative arguments to functions such as (1) socket_recv, (2) socket_recvfrom, and possibly ...

Php Php 4.0 Php Php 4.0.1 Php Php 4.0.2 Php Php 4.0.3 Php Php 4.0.4 Php Php 4.0.5 Php Php 4.0.6 Php Php 4.0.7 Php Php 4.1.0 Php Php 4.1.1 Php Php 4.1.2 Php Php 4.2.0

3 EDB exploits

Integer overflows in (1) base64_encode and (2) the GD library for PHP prior to 4.3.3 have unknown impact and unknown attack vectors.

Php Php 4.0 Php Php 4.0.1 Php Php 4.0.2 Php Php 4.0.3 Php Php 4.0.4 Php Php 4.0.5 Php Php 4.0.6 Php Php 4.0.7 Php Php 4.1.0 Php Php 4.1.1 Php Php 4.1.2 Php Php 4.2

1 2 3 4 5 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook